Anbieter und Datenübermittlungen prüfen

Vendor & International Transfer Review

Evaluate every external vendor and infrastructure service integrated into the product to ensure accurate role classification, valid contractual coverage, and lawful cross-border data transfers.

Vendor & Role Audit

1. Build a Complete Vendor Register from the System:
   • Cross-reference code dependencies, environment variables, infrastructure configs, and billing records to list every external service handling personal or customer data (cloud hosting, managed DBs, CDN/WAF, auth, payments, analytics, crash reporting, email/SMS, support desks, AI/LLM APIs).
2. Qualify Data Protection Role per Vendor:
   • Subprocessor (or Processor): Processes personal data strictly on behalf of the product provider (e.g., cloud hosting, transactional email, enterprise LLM API).
   • Independent Controller: Determines its own purposes and obligations (e.g., regulated payment institutions/banks for AML/fraud, telecom carriers).
   • Joint Controller (Art. 26 GDPR): Jointly determines purposes and means with the provider (e.g., certain embedded social plugins or shared ad-tech pixels per CJEU case law).
3. Verify Article 28 DPA & Subprocessor Flow-Down:
   • Check whether a binding Art. 28 Data Processing Agreement is executed with each processor/subprocessor.
   • Ensure the B2B customer DPA and public Subprocessor List match the actual vendor stack, including processing locations and advance change-notification timelines.

International Data Transfers (GDPR Chapter V)

1. Map Geographic Data Flows & Remote Access:
   • Record both where data is stored at rest and where vendor personnel or sub-subprocessors can access it remotely (since remote access from a third country constitutes a transfer under EDPB Guidelines 05/2021).
2. Verify Transfer Mechanisms (Arts. 44–49):
   • Adequacy Decision (Art. 45): Verify whether the destination country (or a certified US organization under the EU-US Data Privacy Framework) holds an active European Commission adequacy decision.
   • Standard Contractual Clauses (Art. 46(2)(c)): Select the correct Commission SCC Module:
     • Module 1: Controller to Controller (C2C)
     • Module 2: Controller to Processor (C2P)
     • Module 3: Processor to Processor (P2P)
     • Module 4: Processor to Controller (P2C)
   • Transfer Impact Assessment (TIA) & Supplementary Measures: Where relying on SCCs, document whether destination-country laws impinge on effectiveness and what technical (e.g., strong encryption in transit/at rest, pseudonymization) and organizational measures apply.